How the security is built
GrowLeafy Brain LIOS runs on your computer, under your account, with your privileges. Its security comes from where a decision is made, not from language about being secure. This page describes that architecture.
GrowLeafy ID: the single identity root
One GrowLeafy ID identifies you across every Brain, every Skill and every device. It is the root from which everything else follows. Sign-in supports passkeys, multi-factor authentication and one-time codes, so the strongest option available on your device can be used rather than the weakest common one.
Some actions are consequential enough that a normal session is not enough. For those, GrowLeafy requires a step-up: a fresh proof of presence at the moment of the action, not a session that was opened hours earlier.
Device trust: a key that never leaves your machine
Each device generates its own key pair on the machine itself. The private key never leaves that device and is never sent to GrowLeafy. GrowLeafy only ever sees the public half.
When you register a device, GrowLeafy signs a certificate over that device's public key. The device presents that certificate when it acts, so GrowLeafy can tell one machine from another without ever holding the material that would let it impersonate either.
Entitlement: what your account owns
An entitlement is a signed statement that an account owns a capability. It is created only from a verified payment, and it is bound to the account, deliberately not to a device. A device can be replaced or revoked without your ownership changing, because ownership was never a property of the machine.
The statement is retained as it was issued, so its signature can be re-verified later instead of being reconstructed from fields that may since have changed. A signature you cannot re-verify is not evidence.
Least privilege and policy: the AI proposes, policy decides
The model proposes an action. Policy decides whether that action may happen. The model never executes anything itself, and it holds no standing authority: every act that touches your machine is evaluated against the policy in force for your account, your entitlement and your device before it runs.
This is the reason the product is built around capabilities rather than around a single switch that turns an assistant loose. A capability that is not granted is not a capability that is politely declined - it is not available.
Signed software
Release artefacts are signed, so a build can be attributed to the signer that produced it. A build that cannot be attributed to a signer is never presented with a verified badge, however useful it might be.
Clients also hold a public trust anchor out of band. An activation package signed by any other authority is refused, which is why that anchor is published for inspection rather than kept secret.
Revocation
A device can be revoked. Revocation removes that device's authority to act; it does not delete any of your files, and it does not touch your account or your entitlement. Losing a laptop should cost you a laptop, not your work.
You can see and manage your devices from your account, so revocation is something you can do rather than something you have to ask for.
Audit
Consequential actions are recorded: an identity decision, an entitlement being granted or revoked, a device being trusted or removed, a licence check that failed. The record exists so that a question about what happened can be answered from evidence rather than from memory.
Audit is written to be useful during a bad day, which is the only time it matters.
Where to verify this
The public trust anchor that LIOS clients pin is published at the trust anchor endpoint, so you can inspect the key rather than take our word for it.
What happens to data, what is processed locally and what may leave your computer is set out on the privacy page.
What we do not claim
LIOS runs on the customer's own computer with the customer's own privileges, so a determined local administrator can patch a local engine. That is a property of running software on a machine you control, and no amount of architecture removes it.
We therefore do not claim that any GrowLeafy product is unhackable, and we do not describe a licensed capability as impossible to copy on a machine its owner administers.
What we do instead is keep everything that can be enforced on the server on the server: identity, entitlement, activation, revocation and the issuing of signed releases are decided where the customer cannot edit them. The local engine is treated as something that may be tampered with, and the parts that matter are not decided there.